Serhii Demediuk: We need to create a unified cyber incidents investigation system

Representatives of the Office of the National Security and Defence Council took part in the interagency scientific and practical seminar on “Forensic examination in the investigation of cyber incidents and cyberattacks: practical cases and methodological recommendations”.

“We have already learnt to examine digital evidence. However, during modern cyberattacks, in particular those that are part of russian cyber aggression, intruders leave virtually no trace destroying all signs of illegal penetration of systems and data theft. Thus, recording such crimes is effective in the moment of offence”, – emphasised Deputy Secretary of the National Security and Defence Council Serhii Demediuk.

He noted that it requires peculiar approaches to document them and examine further. This is necessary to ensure that it can be used in legal proceedings, including international justice.

“There are already a lot of developments on this matter in various structures. Our goal today is to reach a consensus to create a unified cyber incidents investigation system in the future”, – underlined Serhii Demediuk.

Head of Information and Cyber Security Service at the Office of the NSDC, Secretary of the NCCC, Natalia Tkachuk explained that enhancing the capacity of Ukrainian expert institutions in organising and conducting forensic examinations of computer hardware and software products, including the investigation of malware and the collection of evidence of cyberattacks, is one of the tasks of the Cybersecurity Strategy of Ukraine.

“Since the beginning of russia’s aggression, Ukrainian law enforcement agencies have recorded over 100,000 war crimes. This figure is unprecedented, and we all realise that documenting them cannot be done by a single body, or even the state. Therefore, today the matter of documenting war crimes is a matter for the entire Ukrainian society, as well as our friends and partners. And for this, we need to use digital evidence.” – stressed Natalia Tkachuk

Also, she added that it is already necessary to develop methods of preserving and providing electronic evidence recognisable not only in Ukraine but also in the relevant international institutions.

“I believe that Ukraine will become a leading country that will shape the approaches, accepted throughout the democratic world, to working with digital evidence, investigating cyber incidents and cyberattacks”, – she resumed.

Representatives of the Security Service of Ukraine, the Office of the National Security and Defence Council of Ukraine, the State Special Communications Service, forensic institutions of the Ministry of Justice of Ukraine and the Ministry of Internal Affairs, Taras Shevchenko National University of Kyiv, and the National Union of Journalists of Ukraine joined the professional discussions both offline and online. The topics discussed included recording and preserving electronic evidence that would be recognised not only in Ukraine but also abroad; mechanisms for timely detection and effective counteraction to cyberattacks; problematic aspects and ways to solve them when appointing expert studies and examinations; ways to enhance cooperation between law enforcement agencies and the expert community; forming an evidence base using cyber threat analytics received from foreign partners; ways to ensure high-quality and continuous training of specialists involved in the examination of electronic evidence.

For reference: the interagency scientific and practical seminar on “Forensic examination in the investigation of cyber incidents and cyberattacks: practical cases and methodological recommendations” was organised by the Ukrainian Research Institute of Special Equipment and Forensic Science of the Security Service of Ukraine with the assistance of the National Coordination Centre for Cybersecurity. The main topic of the seminar was modern expert practices and technical approaches used in the investigation of cyber incidents and cyberattacks.